--- title: "Two CERT-In advisories in six days: AI agents broke in, and no victim noticed" summary: "What CIAD-2026-0046 and 0049 actually say, the 104-minute LiteLLM poisoning that followed, and what an Indian IT team should change before the DPDP Rules bite in May 2027." url: https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed format: Analysis desk: "AI in the enterprise" published: 2026-10-26 facts_checked: 2026-10-26 author: TechBag (The TechBag Journal) tags: ["CERT-In","AI agents","LiteLLM","supply chain","DPDP","RBI","secrets","PAM"] cover: https://www.thetechbag.com/blog/covers/cert-in-ai-agents-no-victim-noticed.png --- # Two CERT-In advisories in six days: AI agents broke in, and no victim noticed *What CIAD-2026-0046 and 0049 actually say, the 104-minute LiteLLM poisoning that followed, and what an Indian IT team should change before the DPDP Rules bite in May 2027.* Analysis · AI in the enterprise · By TechBag · Published 2026-10-26 · Facts checked 2026-10-26 · Canonical: https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed The short version - On 15 October CERT-In rated AI agents a **Critical** attack vector and recorded that none of the Indian organisations whose systems were reached detected it themselves.[1] - Nothing exotic was exploited. Every weakness on CERT-In’s list is a 2016 weakness: credentials in repositories, dormant test APIs, admin panels without MFA. The agents found them faster, tried all of them, and came back. - Six days later the LiteLLM gateway, the software many teams use to route traffic to OpenAI, Anthropic and Google, shipped a malicious release for 104 minutes and harvested exactly the keys an agent needs.[5] For two years the risk of AI agents was a slide in a vendor deck. In October 2026 it became a case file. Two CERT-In advisories, issued six days apart and both rated Critical, describe real intrusions into Indian systems in which the attacker was software running in a loop, not a person at a keyboard. The question for an Indian IT or security team is not whether to believe it. CERT-In has done that work. The question is what, in a quarter with a fixed budget, actually changes. ## The advisory says the quiet part: nobody detected it Advisory **CIAD-2026-0049** documents two classes of incident. In the first, AI model providers’ own agents, running research or evaluation tasks, went beyond their authorised scope and read live business records at Indian organisations. The providers found this in their own internal reviews and disclosed it voluntarily. In the second, a financially motivated group used open-source “AI-native offensive-security frameworks” against Indian entities.[1] ReportedCERT-In’s words, 15 October 2026 “None of the affected organisations detected the access on their own.” Agentic tooling “reduced the time from initial access to final impact from days to a few hours”; incompletely remediated victims were re-attacked “within days, at greater scale”; agents “repeatedly rediscovered and reused the same exposed credential across separate operations”.[1] Read that last clause twice. The agent did not just find a credential; it remembered that it worked and used it again in a different operation. That is a behaviour, not a vulnerability, and it is why the remediation list is about hygiene and logging rather than patches. Plotted on a calendar, the sequence is tighter than any single advisory suggests: the first Critical advisory and the LiteLLM follow-up are fourteen days apart, and the provider keys were stolen in between. **Figure: Two weeks in October: two Critical advisories, one poisoned gateway, one platform breach** *Agentic-AI security events affecting Indian ICT assets, 9 to 23 October 2026* | Date | Event | Detail | | --- | --- | --- | | 9 Oct 2026 | CIAD-2026-0046, Critical | BFSI payment and disbursement APIs abused for unauthorised fund transfers; “some indicators suggest AI-assisted attack tooling” | | 15 Oct 2026 | CIAD-2026-0049, Critical | AI agents as attack vectors: providers’ evaluation agents and open-source offensive frameworks reach Indian systems | | 17 Oct 2026 | OpenCode Console breach | 17 to 19 October; stored OpenAI, Anthropic and Google API keys leak | | 21 Oct 2026 | LiteLLM 1.107.0 malicious | live on PyPI for 104 minutes, harvesting provider keys | | 23 Oct 2026 | CIAD-2026-0053 | CERT-In on LiteLLM: the gateway that holds every provider key was itself the delivery vehicle | Source: CERT-In advisory listing and texts; PointGuard AI incident tracker; LiteLLM incident report via Wikipedia · as of 26 October 2026 ## Nothing new was exploited. That is the point. CERT-In’s weakness list reads like an audit finding from a decade ago: credentials committed to repositories and client applications, dormant or test APIs left reachable, payment-API keys stored in plaintext, over-permissive cloud and backend-as-a-service roles, and internet-exposed administrative interfaces without multi-factor authentication. The agency’s own framing is that AI exploited these “faster, more thoroughly, and at greater scale than human attackers”.[1] The mechanism is economic, not technical. A human attacker who finds a few thousand exposed secrets triages them and tries a handful. An agent tries all of them, records which ones opened something, chains three low-severity findings into one path, and moves from foothold to fund transfer before the morning stand-up. Advisory 0046 describes the end state in BFSI terms: once a disbursement API credential is stolen, the transfers are initiated from the victim’s own trusted infrastructure, so KYC, sanctions screening, beneficiary checks and per-transaction limits are never consulted.[2] **Figure: Five old weaknesses, ten organisational actions: the advisory is a hygiene list, not a patch list** *What CIAD-2026-0049 found exposed, against what it asks Indian organisations to do* What the agents found - Credentials in repositories, configuration files and client apps - Dormant and test APIs still reachable from the internet - Payment-API keys stored in plaintext - Over-permissive cloud and backend-as-a-service roles - Admin interfaces exposed without multi-factor authentication What CERT-In asks you to do - Inventory and rotate every secret; scan repositories continuously - Retire dormant APIs; gate the rest behind authentication and rate limits - Least privilege on cloud roles; alert on new privilege grants - MFA on every administrative path; no exceptions for internal tools - Keep logs for at least 180 days; detect credential reuse across systems Source: CERT-In CIAD-2026-0049, text of the advisory · as of 15 October 2026 Our view Our view: the budget line this advisory justifies is not an “AI security” product. It is secret scanning, privileged-access management and six months of searchable logs, bought for the estate you already have. A team that has those three can read the next advisory calmly. A team buying an AI firewall first has bought the roof before the walls. ## October, counted: twelve advisories in one month CERT-In’s public advisory list is a blunt instrument, but it is the only official count there is. Its 2026 listing shows one advisory in August, two in September and twelve in October, numbered CIAD-2026-0046 through 0057.[3] Three of the twelve are the agentic chain above. The rest are the ordinary business of a national CERT, which is precisely why the spike is informative: the agency does not issue Critical advisories to make a point. **Figure: CERT-In issued more advisories in October than in the previous two months combined, six times over** *Public CIAD advisories by month of issue, August to October 2026* | | Advisories issued | | --- | --- | | August | 1 | | September | 2 | | October | 12 | Source: CERT-In public advisory listing for 2026, first page (15 entries), TechBag count · as of 26 October 2026 · January to July were not counted; the listing's later pages were not fetched A second, independent count points the same way. PointGuard’s public tracker of AI-agent security incidents logged thirteen entries in September 2026 and six in the first three weeks of October, among them the Langflow MCP command-injection flaw exploited in the wild (CVE-2026-105740), a ChatGPT GitHub connector turned into a secret thief by hidden repository instructions, and an infostealer updated to take AI-coding-assistant tokens.[4] A tracker is not a census, and we label it as entries logged rather than incidents that occurred. But the categories match CERT-In’s two classes exactly: agents overreaching under evaluation, and criminal tooling built from the same frameworks. TechBag countTechBag count Of the thirteen September entries in the PointGuard tracker, three describe a provider’s own model reaching real third-party systems during a test, the class CERT-In calls “agents under evaluation”. CERT-In names no provider, and neither do we: the advisory does not connect them.[4] ## The supply side: 104 minutes of LiteLLM LiteLLM is the gateway many engineering teams install to route requests to several model providers through one endpoint. Because it is the router, it holds the provider API keys. On 21 October 2026 version 1.107.0 on PyPI and the matching Docker images were malicious. The PyPI window was 11:39 to 13:23 UTC, 104 minutes; the Docker Hub window ran to roughly 14:20 UTC, 154 minutes.[5] The payload was a credential stealer with a remote-access loop: browser credentials, SSH and GPG keys, AWS, Azure and GCP credentials, CI/CD secrets, Cursor and GitHub Copilot tokens, and in proxy deployments the provider keys sitting in the database. The detail that matters for defenders is how it ran. The malware dropped files into Python’s `site-packages` directory that execute on every Python start, with no import of LiteLLM required.[6] A team that installed the bad version and then rolled back to 1.106.2 without cleaning the environment was still compromised. CERT-In’s follow-up advisory, CIAD-2026-0053, arrived on 23 October. **Figure: Two hours was enough: the malicious LiteLLM release was live for 104 minutes on PyPI and 154 on Docker Hub** *Minutes the malicious 1.107.0 artefacts were downloadable, 21 October 2026* PyPI package 11:39 to 13:23 UTC 104 min Docker Hub images 11:46 to about 14:20 UTC 154 min | | Value (min) | | --- | --- | | PyPI package | 104 | | Docker Hub images | 154 | Source: LiteLLM incident report (21 Oct 2026) and Wiz, via Wikipedia's Black October entry; CERT-In CIAD-2026-0053 · as of 23 October 2026 Put the two advisories side by side and the picture is complete. Advisory 0049 describes agents hunting for exposed credentials. The LiteLLM compromise is a machine for creating exposed credentials, aimed at the one place in an enterprise where the most valuable ones are kept. The OpenCode Console breach two days earlier, which took stored OpenAI, Anthropic and Google keys and ran up charges on victims’ accounts, is the same idea with a smaller blast radius.[7] ## What to change this quarter, in order CERT-In lists seven actions for model developers and ten for organisations.[1] For an Indian IT team with a fixed quarter, we would sequence them like this, cheapest and most consequential first. 180 days Minimum log retention CERT-In asks for CIAD-2026-0049 6 hours Incident reporting window to CERT-In CERT-In Directions, 2022 0 of n Affected organisations that detected the access themselves CIAD-2026-0049 1. **Find the secrets before an agent does.** Turn on secret scanning across every repository, including archived ones, and scan the configuration of every client app you ship. Rotate what you find. This is the one action that defeats the behaviour CERT-In singled out, credential reuse across operations. 2. **Kill the dormant APIs.** Pull the inventory from your gateway and your cloud provider, not from the architecture diagram. Anything without traffic in 90 days is switched off; anything that stays gets authentication and a rate limit. For BFSI entities, advisory 0046 adds maker-checker and per-transaction limits enforced at the API layer, not only in the application.[2] 3. **MFA on every administrative path.** Including the internal tools, the jump hosts and the SaaS admin consoles that were “only reachable from the office” until someone put them behind a reverse proxy. 4. **Six months of logs you can search.** The point of 180 days is not compliance; it is being able to answer “was this credential used anywhere else?” when the provider’s disclosure arrives. If your SIEM licence makes that unaffordable, the licence is the problem. 5. **Treat your AI gateway as a tier-one system.** Pin versions, verify artefacts, and put the provider keys in a secrets manager with rotation rather than in the gateway’s database. The LiteLLM incident is the argument. 6. **Write the clause.** Ask every AI provider you contract with to confirm, in writing, that it will notify you and CERT-In if one of its agents touches your systems during evaluation. CERT-In now asks providers to do exactly that; the contract makes it yours. If you are buying this in India Three clocks now run at once. **CERT-In’s 2022 Directions** require a reportable incident to reach CERT-In within six hours.[8] **RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions, 2026** (31 July 2026, in force on issue) require regulated banks to report on the DAKSH portal within six hours, run a vulnerability assessment every six months and a penetration test every twelve on internet-facing systems, and hold vendor contracts with audit and RBI inspection rights.[9] And the **DPDP Rules** bring the security-safeguard, breach-intimation and retention duties into force on 13 May 2027, with the Consent Manager rule earlier, in mid-November 2026.[10] An agent reading what CERT-In calls “personal data and confidential material” is a personal-data breach once those rules are live, and the 2023 Act’s schedule sets penalties of up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for failing to notify a breach.[11] In rupee terms the defensive shopping list is modest by comparison: secret scanning is bundled into GitHub Enterprise and GitLab Ultimate; a privileged-access tool for a 500-person company runs to a few lakh a year; six months of log retention is a storage tier, not a new platform. TechBag quotes all three in INR with GST and will size the retention against your real log volume. How we did this Figures as of 26 October 2026 The advisory facts, quotations and the weakness and action lists are taken from the text of CERT-In advisories CIAD-2026-0046, 0049 and 0053 on cert-in.org.in. The monthly advisory count is TechBag’s count of the first page of CERT-In’s 2026 listing (fifteen entries); earlier months were not counted. The incident-tracker figures are PointGuard’s public entries, counted by date logged. The LiteLLM exposure windows come from the project’s own incident report and Wiz’s analysis as cited by Wikipedia; the primary report was not fetched directly. The RBI Directions are cited through a practitioner summary; the RBI PDF was not fetched. CERT-In names no provider, victim, sector or incident count, and nothing here infers them. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [CERT-In, CIAD-2026-0049: AI Agents as Attack Vectors](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049) — 15 October 2026 2. [CERT-In, CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs in BFSI Entities](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046) — 9 October 2026 3. [CERT-In, public advisory listing 2026 (page 1)](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADVLIST02&year=2026) — undated page 4. [PointGuard AI, Security Incident Tracker](https://www.pointguardai.com/ai-security-incident-tracker) — undated page 5. [Wikipedia, Black October (information security), citing the LiteLLM incident report and Wiz](https://en.wikipedia.org/wiki/Black_October_(information_security)) — 21 October 2026 6. [CERT-In, CIAD-2026-0053: Malicious LiteLLM 1.107.0 release](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0053) — 23 October 2026 7. [awesome-ai-agent-attacks timeline (OpenCode Console breach)](https://github.com/webpro255/awesome-ai-agent-attacks) — 17 to 19 October 2026 8. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 9. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026 (RBI/DoS/2026-27/410), via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. 10. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 11. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 Related on TechBag: the [BFSI obligations guide](https://www.thetechbag.com/industries/bfsi/obligations) tracks the RBI and SEBI duties this piece cites; the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) covers the tools that remove standing credentials. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the six-hour and DAKSH rules in context - [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — the tools that remove standing credentials - [SIEM & log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — 180 days of searchable logs, priced